DotNet CLR DLL Loaded By Scripting Applications

Title: DotNet CLR DLL Loaded By Scripting Applications
Status: test
Description:Detects .NET CLR DLLs being loaded by scripting applications such as wscript or cscript. This could be an indication of potential suspicious execution.
References:
  -https://github.com/tyranid/DotNetToJScript
  -https://thewover.github.io/Introducing-Donut/
  -https://web.archive.org/web/20230329154538/https://blog.menasec.net/2019/07/interesting-difr-traces-of-net-clr.html
  -https://web.archive.org/web/20221026202428/https://gist.github.com/code-scrap/d7f152ffcdb3e0b02f7f394f5187f008
Author: omkar72, oscd.community
Date: 2020-10-14
modified:2023-02-23
Tags:

• -'attack.execution'
• -'attack.privilege-escalation'
• -'attack.stealth'
• -'attack.t1055'

Logsource:

• category: image_load
• product: windows

Detection:
  selection:
    Image|endswith:
      -'\cmstp.exe'
      -'\cscript.exe'
      -'\mshta.exe'
      -'\msxsl.exe'
      -'\regsvr32.exe'
      -'\wmic.exe'
      -'\wscript.exe'

    ImageLoaded|endswith:
      -'\clr.dll'
      -'\mscoree.dll'
      -'\mscorlib.dll'

  condition:selection
Falsepositives:
  -Unknown
Level: high